| elastic |
GRUB Configuration Generation through Built-in Utilities |
production |
2026-10-09 |
| elastic |
Potential Proxy Execution via Systemd-run |
production |
2026-10-09 |
| elastic |
Shared Object Load via LoLBin |
production |
2026-10-09 |
| elastic |
Unusual Process Modifying GenAI Configuration File |
production |
2026-10-06 |
| elastic |
Shared Object Created by Previously Unknown Process |
production |
2026-10-05 |
| elastic |
Node.js Pre or Post-Install Script Execution |
production |
2026-09-25 |
| elastic |
Suspicious DLL Loaded for Persistence or Privilege Escalation |
production |
2026-09-18 |
| elastic |
Potential DLL Side-Loading via Trusted Microsoft Programs |
production |
2026-09-18 |
| elastic |
Suspicious Microsoft Antimalware Service Execution |
production |
2026-09-18 |
| elastic |
Potential Masquerading as System32 DLL |
production |
2026-09-18 |
| elastic |
Potential Windows Session Hijacking via CcmExec |
production |
2026-09-18 |
| elastic |
Unsigned DLL Side-Loading from a Suspicious Folder |
production |
2026-09-18 |
| elastic |
Signed Proxy Execution via MS Work Folders |
production |
2026-09-18 |
| elastic |
WPS Office Exploitation via DLL Hijack |
production |
2026-09-18 |
| elastic |
Execution via local SxS Shared Module |
production |
2026-09-18 |
| elastic |
Unsigned DLL Loaded by Svchost |
production |
2026-09-18 |
| elastic |
Unusual Persistence via Services Registry |
production |
2026-09-18 |
| elastic |
Persistence via TelemetryController Scheduled Task Hijack |
production |
2026-09-18 |
| elastic |
Persistence via Update Orchestrator Service Hijack |
production |
2026-09-18 |
| elastic |
Potential privilege escalation via CVE-2022-38028 |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via InstallerFileTakeOver |
production |
2026-09-18 |
| elastic |
Suspicious Print Spooler Point and Print DLL |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via Service ImagePath Modification |
production |
2026-09-18 |
| elastic |
Privilege Escalation via Windir Environment Variable |
production |
2026-09-18 |
| elastic |
UAC Bypass Attempt via Privileged IFileOperation COM Interface |
production |
2026-09-18 |
| elastic |
Potential Exploitation of an Unquoted Service Path Vulnerability |
production |
2026-09-18 |
| elastic |
Dynamic Linker Modification Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Suspicious Echo or Printf Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Potential Persistence via File Modification |
production |
2026-09-18 |
| elastic |
Dynamic Linker Creation |
production |
2026-09-18 |
| elastic |
Unusual LD_PRELOAD/LD_LIBRARY_PATH Command Line Arguments |
production |
2026-09-18 |
| elastic |
Dynamic Linker (ld.so) Creation |
production |
2026-09-18 |
| elastic |
System Binary Symlink to Suspicious Location |
production |
2026-09-18 |
| elastic |
Unusual Preload Environment Variable Process Execution |
production |
2026-09-18 |
| elastic |
Suspicious Dynamic Linker Discovery via od |
production |
2026-09-18 |
| elastic |
Pod or Container Creation with Suspicious Command-Line |
production |
2026-09-18 |
| elastic |
Suspicious Path Invocation from Command Line |
production |
2026-09-18 |
| elastic |
Suspicious APT Package Manager Execution |
production |
2026-09-18 |
| elastic |
APT Package Manager Configuration File Creation |
production |
2026-09-18 |
| elastic |
Suspicious APT Package Manager Network Connection |
production |
2026-09-18 |
| elastic |
Boot File Copy |
production |
2026-09-18 |
| elastic |
DNF Package Manager Plugin File Creation |
production |
2026-09-18 |
| elastic |
DPKG Package Installed by Unusual Parent Process |
production |
2026-09-18 |
| elastic |
Unusual DPKG Execution |
production |
2026-09-18 |
| elastic |
Dracut Module Creation |
production |
2026-09-18 |
| elastic |
Dynamic Linker Copy |
production |
2026-09-18 |
| elastic |
Initramfs Extraction via CPIO |
production |
2026-09-18 |
| elastic |
Git Hook Command Execution |
production |
2026-09-18 |
| elastic |
Git Hook Created or Modified |
production |
2026-09-18 |
| elastic |
Git Hook Egress Network Connection |
production |
2026-09-18 |
| elastic |
Git Hook Child Process |
production |
2026-09-18 |
| elastic |
GRUB Configuration File Creation |
production |
2026-09-18 |
| elastic |
NetworkManager Dispatcher Script Creation |
production |
2026-09-18 |
| elastic |
Python Path File (pth) Creation |
production |
2026-09-18 |
| elastic |
RPM Package Installed by Unusual Parent Process |
production |
2026-09-18 |
| elastic |
Python Site or User Customize File Creation |
production |
2026-09-18 |
| elastic |
Potential Suspicious File Edit |
production |
2026-09-18 |
| elastic |
Suspicious Network Connection via systemd |
production |
2026-09-18 |
| elastic |
Initramfs Unpacking via unmkinitramfs |
production |
2026-09-18 |
| elastic |
Yum Package Manager Plugin File Creation |
production |
2026-09-18 |
| elastic |
Potential CVE-2025-32463 Nsswitch File Creation |
production |
2026-09-18 |
| elastic |
Suspicious Kworker UID Elevation |
production |
2026-09-18 |
| elastic |
Modification of Dynamic Linker Preload Shared Object |
production |
2026-09-18 |
| elastic |
Suspicious Symbolic Link Created |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via PKEXEC |
production |
2026-09-18 |
| elastic |
Potential snap-confine Privilege Escalation via CVE-2026-3888 |
production |
2026-09-18 |
| elastic |
Potential Sudo Hijacking |
production |
2026-09-18 |
| elastic |
UID Elevation from Previously Unknown Executable |
production |
2026-09-18 |
| elastic |
Dylib Injection via Process Environment Variables |
production |
2026-09-18 |
| elastic |
Modification of Environment Variable via Unsigned or Untrusted Parent |
production |
2026-09-18 |
| elastic |
Persistence via DirectoryService Plugin Modification |
production |
2026-09-18 |
| elastic |
Untrusted DLL Loaded by Azure AD Connect Authentication Agent |
production |
2026-09-18 |
| elastic |
Suspicious Antimalware Scan Interface DLL |
production |
2026-09-18 |
| elastic |
Deprecated - Suspicious PrintSpooler Service Executable File Creation |
deprecated |
2026-08-19 |
| elastic |
Deprecated - Adobe Hijack Persistence |
deprecated |
2026-08-19 |
| elastic |
Potential CVE-2025-41244 vmtoolsd LPE Exploitation Attempt |
deprecated |
2026-08-03 |
| splunk |
Windows Rundll32 Execution With Log.DLL |
production |
2026-05-13 |
| splunk |
Windows PowerShell Module File Created |
production |
2026-05-13 |
| splunk |
Windows Set Custom DNS ServerLevelPlugin Via Dnscmd |
production |
2026-05-13 |
| splunk |
Windows BitDefender Submission Wizard DLL Sideloading |
experimental |
2026-05-13 |
| splunk |
Windows Mock Trusted Directory MSC File Creation |
production |
2026-05-13 |
| elastic |
Deprecated - Suspicious File Creation in /etc for Persistence |
deprecated |
2025-06-26 |
| elastic |
Deprecated - Potential Process Injection via LD_PRELOAD Environment Variable |
deprecated |
2023-09-25 |
| sigma |
Potential Registry Persistence Attempt Via DbgManagedDebugger |
test |
2023-08-17 |
| sigma |
Suspicious Printer Driver Empty Manufacturer |
test |
2023-08-17 |
| sigma |
Regsvr32 DLL Execution With Uncommon Extension |
test |
2023-05-24 |
| sigma |
Potential PrintNightmare Exploitation Attempt |
test |
2023-02-17 |
| sigma |
Potential Initial Access via DLL Search Order Hijacking |
test |
2022-10-21 |
| sigma |
Windows Spooler Service Suspicious Binary Load |
test |
2022-06-02 |
| sigma |
DLL Execution Via Register-cimprovider.exe |
test |
2021-11-27 |
| sigma |
Exploiting SetupComplete.cmd CVE-2019-1378 |
test |
2021-11-27 |
| sentinel |
COM Registry Key Modified to Point to File in Color Profile Folder |
Scheduled |
— |